How did the Netherlands build its AML legal framework? A short history
Since 1 January 2026 the Wwft has carried article 1f: traders in goods, art traders and pawnshops may not make or accept a cash payment for goods of €3,000 or more, linked payments counted together. The version in force on 1 July 2025 had no such article. It is the newest layer of a law that, like the AML rules of other jurisdictions, grew out of EU directives.
Dutch anti money laundering law started with the first EU directive, AMLD1 (1991), and two Dutch acts of 1993, one on identifying customers and one on reporting unusual transactions. The Wwft, the Wet ter voorkoming van witwassen en financieren van terrorisme (in DNB's English, the "Anti-Money Laundering and Anti-Terrorist Financing Act"), was signed on 15 July 2008 and repealed both (art. 49). Later amendments carried AMLD4 (2018) and AMLD5 (2020) into it, and the consolidated text in force since 1 July 2026 is the one this guide cites.
Four more laws complete the stack. The Sanctions Act 1977 gives sanctions measures force in Dutch law. The Economic Offences Act (WED) turns an intentional Wwft breach into a crime. The Financial Supervision Act (Wft) licenses the banks and insurers that the Wwft obliges. Bonaire, Sint Eustatius and Saba have their own act, the Wwft BES.
Criminal Code article 420bis reaches the proceeds of any crime, while Directive (EU) 2018/1673 sets a floor: any offense punishable by more than one year in prison, plus 22 predicate offense categories in any case.
Older Dutch guides call 2018/1673 the sixth directive. The AMLD6 of the 2024 EU package is another text, Directive (EU) 2024/1640, which member states must transpose by 10 July 2027, with a few articles due earlier and one later (art. 78).
Who supervises Dutch firms? The government and regulatory role in AML
| Supervisor | Who it supervises (Wwft art. 1d, text of 1 July 2026) | AML role (as of November 2026) |
|---|---|---|
| DNB (De Nederlandsche Bank, the Dutch central bank) | Banks, non bank lenders, payment and electronic money institutions, exchange offices, life insurers, payment agents, trust offices; crypto services offered by a bank or electronic money institution | Wwft and Sanctions Act supervisor; transfer of funds rules for payment service providers (art. 1d(2)) |
| AFM (Dutch Authority for the Financial Markets) | Investment firms, investment funds and UCITS, life insurance intermediaries, other crypto service providers (CASPs) | Wwft supervisor; crypto transfer rules for CASPs (art. 1d(3)) |
| BFT (Bureau Financieel Toezicht) | Tax advisers, accountants, notaries and similar legal professions | Wwft supervisor |
| Dean of the bar (deken) | Lawyers | Wwft supervisor |
| Minister of Finance (Dienst Financieel-Economische Integriteit, DFEI, which took over from the Bureau Toezicht Wwft on 1 January 2026) | Real estate agents and valuers, traders in goods, art traders, pawnshops, brokers in vehicles, ships, art, antiques, precious stones, metals and jewelry, address providers | Wwft supervisor, including the art. 1f cash ban |
| Kansspelautoriteit (Gaming Authority) | Casinos and other games of chance | Wwft supervisor |
| FIU-the Netherlands | Receives reports from every institution | Analyzes unusual transactions and declares some suspicious; sits under the Minister of Justice (art. 12) |
Supervisors check compliance, but none of them receives reports. A firm reports unusual transactions, and the indicators set by decree under article 15 decide what counts as unusual, so the net is wider than suspicion. FIU-the Netherlands then picks out the suspicious reports and passes them to police and prosecutors.
EU sanctions regulations apply directly in the Netherlands, and the Sanctions Act 1977 gives them and national measures force in Dutch law. DNB checks how banks and other financial firms comply.
Five more bodies shape the system without supervising firms:
- Ministry of Finance. Sets AML policy with the Ministry of Justice and Security; the two ministers publish the national risk report and update it every two years (art. 1g).
- FIOD. The Tax Administration's investigation service, which investigates laundering cases with the police.
- AMLC. The Anti Money Laundering Centre, an expertise center hosted by the FIOD.
- CPB. The Netherlands Bureau for Economic Policy Analysis, which assesses the effects of policy for the government.
- Autoriteit Persoonsgegevens. The data protection authority, which supervises how firms process personal data under the GDPR, AML files included.
Which firms does the Wwft cover?
Article 1a sorts obliged institutions into three groups. Banks come first, including Dutch branches of banks based abroad (1a(2)). Other financial undertakings follow (1a(3)): non bank lenders, payment service providers, investment firms and funds, electronic money institutions, exchange offices, life insurers and their intermediaries, payment agents, CASPs, and Dutch branches of foreign firms of these kinds. The third group (1a(4)) holds tax advisers, accountants, lawyers and notaries for named services, trust offices, address providers, real estate agents (rentals included from €10,000 a month), brokers of high value goods, art traders (payments from €10,000), casinos, property valuers and pawnshops.
Traders in goods stay on that list (1a(4)(i)), yet the only Wwft duty they carry is the article 1f cash ban (1a(1)).
Picture a mortgage lender in Utrecht with no banking license. Lending is an activity under 1a(3)(a), so the Wwft applies and DNB supervises the lender (art. 1d(1)(a)). The agent who sells the house answers to the Minister of Finance (art. 1d(1)(e)).
What are the AML compliance key points under the Wwft?
The table maps twelve duties, from customer due diligence under article 3 to staff training under article 35, each with the article as in force on 1 July 2026. Its last column shows where complead, formerly Sanction Scanner, fits each duty; Sanction Scanner, the screening product, is part of complead. Three duties sit outside the rows:
- Accountability (art. 2d). Where two or more people run the firm, one of them answers for Wwft compliance. A firm whose nature and size call for it also keeps an independent compliance function.
- Technology (art. 33(4)). Systems must answer the FIU or the supervisor without delay, for example whether the firm has served a given client in the past five years.
- Cooperation (art. 23(6)). Banks and financial firms of one group may share a report despite the tipping off ban when group policies are met, so a cross border group can act on one finding.
| Obligation | Legal basis (Wwft, text of 1 July 2026) | What the firm must do | Where complead fits |
|---|---|---|---|
| Risk assessment and policies | Arts. 2b, 2c | Identify and assess money laundering and terrorist financing risks, record the result, and keep policies, procedures and controls in proportion to the business. | Rule and threshold changes are versioned: the log names who changed what, when and why, and one click rolls a change back. |
| Customer due diligence | Art. 3(2), 3(5), 3(6) | Identify and verify the client and learn the purpose of the relationship, at onboarding, for occasional transactions of at least €15,000, transfers of funds of at least €1,000 and game of chance transactions of at least €2,000, and also on signs of money laundering or terrorist financing, doubts about earlier client data, an existing client's risk or a higher risk home state (art. 3(5)(c) to (f)). | Onboarding, screening and monitoring results meet in a single score per customer; each screening search is logged with the searcher, the name, the time and the result. |
| Ultimate beneficial owner | Art. 3(2)(b), 3(15); implementing decree (more than 25 percent) | Identify the ultimate beneficial owner, take reasonable steps to verify identity, understand the ownership and control structure, and never rely only on the trade register or the trust UBO register. | KYB and UBO verification traces owners upward, with no fixed depth cap, until it reaches natural persons, and any layer left open is reported as unresolved; whether the structure is acceptable is a determination for your compliance function. |
| Politically exposed persons | Art. 8(6) to (8) | Run risk based procedures to find PEPs among clients and UBOs; get senior management approval, establish the source of wealth and of funds, and keep the relationship under enhanced monitoring; keep measures for at least 12 months after a PEP leaves office. | A PEP match counts toward the customer's single score; approval stays a human decision, and the record names who made it. |
| Enhanced due diligence | Arts. 8(1), 8(3), 8(4), 9 | Apply EDD to higher risk relationships, clients in states the European Commission designates, complex or unusually large transactions and correspondent relationships with respondents outside the EEA. | Rules can be scoped by product, segment or jurisdiction, so designated states run under their own EDD rules. |
| Unusual transaction report | Arts. 15, 16(1), 23 | Report a done or intended unusual transaction to FIU-the Netherlands "onverwijld" (without delay) once its unusual nature is known; keep the report secret, the client included, though a lawyer, notary, tax adviser or accountant may still try to talk a client out of an illegal act (art. 23(5)). | Reporting support within case management. |
| Sanctions | Sanctions Act 1977 | Screen clients and payments against EU and Dutch sanctions measures, freeze hits and report them to the supervisor. | Searches run across 3,500+ sanctions, PEP and watchlists from 220+ jurisdictions, refreshed every 15 minutes, and no match results are logged too. |
| Ongoing monitoring | Art. 3(2)(d), 3(10) | Monitor the relationship and its transactions against the client's risk profile, and keep client data up to date. | Monitoring of a name is switched on or off by an API trigger, so names that no longer matter stop being screened. |
| Transfers of funds and crypto | Regulation (EU) 2023/1113; art. 8(5) | Carry payer and payee data on transfers of funds and crypto transfers; apply risk measures to crypto transfers to or from self hosted addresses. | During processing, the API screens both the sender and the receiver of each transfer. |
| Cash ban | Art. 1f, from 1 January 2026 | Traders in goods, art traders and pawnshops refuse cash payments for goods of €3,000 or more, linked payments included. | A cash threshold rule is set up in the rules engine without code, and a backtest over a 30, 60 or 90 day window shows its alert volume first. |
| Record keeping | Art. 33(1), 33(3) | Keep CDD documents and data until five years have passed since the relationship ended or the transaction was carried out. | The search audit trail holds the who, what, when and result of every check. |
| Training | Art. 35 | Screen staff, make them familiar with the Wwft and train them periodically to recognize unusual transactions and complete CDD. | Every alert names the rule behind it and the signals it matched, so training can use the team's own past decisions. |
Get the 2026 PDF. For the compliance file: the 16 page edition adds a 14 point program checklist and two templates to this guide. Fields: work email, company, country, role. Button: Get the PDF checklist
Where do the euro lines sit in 2026?
Six euro amounts set Dutch onboarding rules: €15,000 for an occasional transaction (art. 3(5)(b)), €1,000 for an occasional transfer of funds (3(5)(g)), €2,000 at games of chance (3(6)), €10,000 a month in rent before a letting agent is covered (1a(4)(h)), €10,000 in payments before an art trader is covered (1a(4)(k)) and €3,000 in cash for goods (1f). Linked payments count together for every line except the rent and the transfer. The UBO line of more than 25 percent comes from the implementing decree, not from the act itself.
| Rule | Netherlands, Wwft text of 1 July 2026 | EU, AMLR from 10 July 2027 |
|---|---|---|
| Cash payments | Banned for goods at €3,000 or more for traders in goods, art traders and pawnshops (art. 1f, since 1 January 2026) | €10,000 cap for goods or services across the EU; a member state may keep a lower limit, so the Dutch €3,000 line can stay (AMLR art. 80(2), (3)) |
| Rulebook | A national act, the Wwft, enforced by six supervisors (art. 1d) | AMLR applies directly; a Dutch implementation act transposes AMLD6, Directive (EU) 2024/1640 |
| Direct EU supervision | None | AMLA starts selecting up to 40 credit and financial institutions by 1 July 2027 and supervises them directly from 2028 |
| Crypto transfers | Transfer data rules of Regulation (EU) 2023/1113 since 30 December 2024; DNB or the AFM by firm type (art. 1d(2), (3)) | Regulation (EU) 2023/1113 keeps applying |
Where does the Netherlands carry money laundering risks as a country?
Picture a Rotterdam importer that pays suppliers in three countries, is owned through a trust office structure and buys an Amsterdam office building. Each of those facts touches a risk area the old version of this guide named.
- Trade hub. Goods moving through Dutch ports can hide value in invoices, so payment patterns need monitoring against the client's profile (art. 3(2)(d)).
- Real estate. Agents, valuers and notaries are all obliged institutions, so one purchase passes several gatekeepers.
- Shell companies and trusts. Trust offices are licensed under the Wtt 2018, and article 3(15) bars firms from relying only on the trade register or the trust UBO register.
- Banking sector. ABN AMRO, ING, de Volksbank, Triodos Bank and Rabobank set up Transaction Monitoring Netherlands (TMNL) to monitor payments jointly.
- Organized crime. Threat rankings move, so cite the national risk report that the two ministers update every two years (art. 1g).
For Netherlands high risk countries, the Wwft points to the European Commission's list: a client based in a designated state triggers enhanced due diligence (arts. 8(1)(b), 9). The Netherlands is also a FATF member.
How large can Dutch AML fines and prison terms get?
| Breach or offense | Basis | Maximum (in force, November 2026) |
|---|---|---|
| Wwft breach, category 1 | Wwft art. 31(2) | €10,000 |
| Wwft breach, category 2 | Wwft art. 31(2) | €1 million |
| Wwft breach, category 3 | Wwft art. 31(2), (3) | €4 million; €5 million for banks, other financial undertakings and trust offices |
| Repeat within five years | Wwft art. 31(4) | Twice the maximum, up to €10 million |
| Turnover based fine | Wwft art. 32(1) | For a category 3 breach by a bank, other financial undertaking or trust office: up to 20% of the prior year's net turnover, where that exceeds twice the art. 31(3) maximum |
| Order subject to a periodic penalty (last onder dwangsom) | Wwft art. 29 | Payments until the breach ends |
| Laundering | Criminal Code art. 420bis | 6 years in prison or a fifth category fine (€110,000 from 1 January 2026) |
| Habitual laundering, or laundering in the course of a profession or business | Criminal Code art. 420ter | 8 years in prison or a fifth category fine |
| Culpable laundering (the person should reasonably have suspected the criminal source) | Criminal Code art. 420quater | 2 years in prison or a fifth category fine |
| Legal person convicted | Criminal Code art. 23(7) | Where the offense's own category is too low for a fitting penalty, a fine from the next category up (sixth: €1,100,000); where a sixth category fine applies and is too low, up to 10% of the prior year's turnover |
| Intentional Wwft breach | Economic Offences Act (WED) | Prosecuted as an economic offense |
Two tracks run side by side. DNB and the other supervisors impose administrative fines and orders under the Wwft and publish them. The Public Prosecution Service brings criminal cases under the Criminal Code and the WED, and settles some of them. The criminal fine categories rose on 1 January 2026, so older amounts found in search results are out of date.
Recent enforcement by DNB and the prosecutor
DNB's own findings show what a monitoring failure looks like. In its CCV decision, published 13 July 2026, the monitoring system was not fully fed with merchant transactions for over two years, transaction profiles for 4,200 merchants (about 8 percent) were missing for 23 months, and alerts were closed without enough reasons. Dutch amounts sit below the biggest AML fines on record, yet the finding repeats: alerts that nobody worked.
| Firm | Date | Penalty | Finding | Source |
|---|---|---|---|---|
| CCV Netherlands (payment institution) | Published 13 July 2026 | €2.65 million | Transactions not continuously monitored and alerts closed without sufficient reasons (Wwft art. 3(2)); a prior fine raised the base amount | DNB release |
| ABN AMRO | Imposed 6 July 2026 | €8.5 million after a simplified settlement | Ongoing monitoring of part of its high risk customers, September 2023 to September 2024 | DNB release |
| de Volksbank | Imposed 22 January 2025 | €5 million under the Wwft (plus €15 million under the Wft) | Customers not adequately monitored and alerts followed up late, July 2020 to at least April 2023 | DNB release |
| ABN AMRO | 19 April 2021 | €480 million settlement | Structural Wwft breaches, also charged as culpable money laundering | Public Prosecution Service |
| ING | 4 September 2018 | €775 million settlement | Client due diligence and unusual transaction reporting failures, 2010 to 2016, also charged as culpable money laundering | Public Prosecution Service |
Which AML solutions fit a Dutch program? Screening and monitoring
When DNB or the AFM examines a file, it reads records: which list a name was checked against, which rule produced an alert, and who closed it on what date. A control that leaves no record is hard to show.
Client screening and ongoing monitoring logs each search with the person who ran it, the name, the time and the result. The lists it checks reach 3,500+ sanctions, PEP and watchlists from 220+ jurisdictions, refreshed every 15 minutes.
Picture a Dutch payment institution, the kind of firm DNB fined in the CCV case. It can run a lower fuzzy matching threshold on sanctions lists than on watchlists, because thresholds are set per list type and per list. Its alert rules sit in transaction monitoring, written without code and backtested before release. complead is an AI native platform. Routine cases go to agents, which close them with the evidence, a written narrative and the work log on file; the compliance officer takes every other call, and the record names who made it.
Which Dutch AML dates matter from 2024 to 2027?
- 30 December 2024. Regulation (EU) 2023/1113 and MiCA apply to crypto transfers and crypto service providers.
- 22 January 2025. DNB fines de Volksbank €5 million under the Wwft and €15 million under the Wft.
- 1 January 2026. Article 1f bans cash payments for goods of €3,000 or more, the criminal fine categories rise and the DFEI takes over the Minister of Finance's Wwft supervision.
- 1 July 2026. The current consolidated Wwft text takes effect.
- 6 July 2026. DNB fines ABN AMRO €8.5 million.
- 13 July 2026. DNB publishes its €2.65 million fine on CCV.
On 10 July 2027 the EU AML Regulation, (EU) 2024/1624, starts to apply directly with its €10,000 cash cap, and the main AMLD6 transposition deadline falls on the same day. By 1 July 2027 AMLA, the new EU authority seated in Frankfurt, begins selecting up to 40 institutions, which it supervises directly from 2028.
So the decision this guide leaves with you is a timing one: when to move rules keyed to Wwft article numbers onto AMLR articles. Hold the Dutch lines, such as the €3,000 cash ban and the unusual transaction indicators, as separate parameters so they survive the switch, and give the remap an owner well before 10 July 2027. For customer due diligence, the free EU AMLR customer due diligence form shows the AMLR article behind most of its 54 questions, which gives that owner a first mapping to check.
What the 2026 PDF adds. The page above is the whole guide. The PDF puts the paperwork in one place for your file: a 14 point program checklist ordered the way a Dutch supervisor tends to work through a visit, a customer risk factor template for the Netherlands, and an unusual transaction decision record that also logs the cases reviewed and not reported. Button: Get the PDF checklist (to #pdf-form)
